- cypherpunks-legacy - lists.cpunks.org

Re: ANI Blocking! Fast, Easy, Effective! (fwd)
by Bruce M. 17 Dec '03

17 Dec '03

> ---------- Forwarded message ---------- > Date: Thu, 4 JUL 1996 14:48:28 GMT > From: Glen L. Roberts <glr(a)ripco.com> > Newgroups: alt.2600, alt.privacy, alt.private.investigator, > alt.dcom.telecom, > comp.dcom.telecom.tech, alt.security, misc.consumers > Subject: ANI Blocking! Fast, Easy, Effective! > We are in the beta teating phase of a new service to block ANI. > You'll be able to call any toll-free number and prevent them from > getting your phone number. We do not charge for this service (you > do have to call a long distance number). > Complete details are on our web page. As we are beta testing, we > can't say for such what problems might crop up, but let us know. > http://pages.ripco.com:8080/~glr/block.html > ------ > Purity of Opinion through force of Intimidation: > http://pages.ripco.com:8080/~glr/rogue > Web Site for FBI File Access! You, too can be like Pres Clinton! > http://pages.ripco.com:8080/~glr/fbi.html > ------ I thought this might be of interest due of the recent discussions about ANI and privacy. I've seen this type of service before, but this one is apparently free (besides the cost of calling their area code if you aren't local). ________________________________ [ Bruce M. - Feist Systems, Inc. ] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ "Official estimates show that more than 120 countries have or are developing [information warfare] capabilities." -GAO/AIMD-96-84

3 4

Cybank breaks new ground; rejects public-key encryption
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: Ian Grigg <iang(a)systemics.com> MIME-Version: 1.0 Precedence: Bulk Date: Sat, 13 Jul 1996 22:55:43 +0200 From: Ian Grigg <iang(a)systemics.com> To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: Cybank breaks new ground; rejects public-key encryption This taken from their pages (http://www.cybank.net/cb-encr.htm) --------------------------------- Security and Encryption Cybank software is protected by multiple encryption and identification systems, some can be seen, others are invisible. Cybank cash can be traced back to the original account it belongs to. Cash Keys cannot effectively be modified with disabling them. Because cash keys are also password protected, they can only be created and spent by the authorised account holder. Cybank uses an encryption matrix of 380 characters. Cybank can safely transfer any Cash Key or message from point A to point B via the Internet. Cybank DOES NOT use Public Key Encryption (which has proven to be insecure). Here is a sample encrypted code, see if you can understand it: 193404158201838932119642777371870823541340764 [...] ------------------------------- I wonder if they intend to publish the protocols :-) -- iang iang(a)systemics.com --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

3 2

Re: Execution of signed scripts received by e-mail
by Matt Carpenter 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Steffen Zahn <zahn(a)berlin.snafu.de> writes: > Matt> Get one input line at a time, and look for Reply-To: and > att> From: headers to get a reply address. As we are slurping up > Matt> lines, watch for '-----BEGIN PGP' lines. If it is for > >I suggest ignoring Reply-To: etc and requiring a return address inside >the signed region of the mail, otherwise someone could intercept the mail >(suppressing the original) and resend it from his account and the results >would get sent to the interceptor. This is a very good suggestion. I'll change emscrypt to use this. > Another idea would be to extract the return address from the PGP userid >which signed the script. I see that Mark M. has already commented on this, but I'll also add that I didn't want to limit the reply to the address attached to the key. For example, I have several accounts spread around, and I might want the replies to go to anyone of them. >Regards > Steffen Thanks for the input. - --Matt - -- mcarpent(a)mailhost.tcs.tulane.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMejLASjtJAMyBnp9AQEWyAf+IgmEApjh7CGo+sdCueH9BPQKLb9Dk7Qj 1HK7HoR8Dz/TnDPLicJgiaYj9z8gDfGLYWu2L4UIDIgQukb3o1JWOshTQAgyoCe9 gYxTYHvroNqMvq3ptPeeY73NVGsyTZnlcYJ/dlhWT90jReCZmIcrbpJNt+TIgGcm /s57Nw2zJzM8RrIWsCqs7gM0qogR2e71Gn4M+UFz9BfmMEw4X8qwZcD5M1//9VSi TqDjWnVucuUoWVZk+Bb6lKcxPwlAx6BxUZLaNaZrPlqvrSYJS4l451vgWkpcixSy Uuj+LU0cPd6qA3CHRHF4nllf3JcMP3uJeeWbmFjOZ+ItKkyQTSIVwQ== =JIXQ -----END PGP SIGNATURE-----

1 0

[LONG,FUNNY,NOISE] Cypherpunk wannabe threatens a lawsuit :-)
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Cypherpunks, I offer these two Usenet articles for your amusement. In article 1, I follow up on Bruce Bough's article, and, among many other things, defend his right to vote (questioned by the orthodox Jewish homophobe Dan Hartung). (It's very long and technical, so you can skip it.) In article 2, Bruce Bough follows up on my article and threatens to prosecute me under the Americans with Disability Act for misspelling his name. This is almost as funny as his litanies about his dementia and memory loss. Have fun. Article 1: =============================================================================== From: dlv(a)bwalk.dm.com (Dr. Dimitri Vulis) Newsgroups: news.admin.net-abuse.misc,news.admin.censorship,news.admin.policy,alt.config,news.groups,alt.journalism,atl.general,alt.culture.usenet,alt.internet.media-coverage,alt.wired,alt.cyberspace,talk.politics.misc,news.admin.net-abuse.misc,ga.general,misc.news.internet.discuss,soc.culture.russian,alt.flame.jan-isley,talk.forgery,alt.usenet.kooks,alt.grelb Subject: Re: Towards A Usenet Social Contract References: <4rpvfi$smg(a)doc.jmu.edu> <4rv6m7$3ns_002(a)mycroft.kenosis.com> Message-ID: <i6a1qD209w165w(a)bwalk.dm.com> Date: Sat, 13 Jul 96 09:25:41 EDT In article <4rv6m7$3ns_002(a)mycroft.kenosis.com>, bruce(a)kenosis.com (Bruce Baugh) wrote: >In article <4rpvfi$smg(a)doc.jmu.edu>, bumgarls(a)falcon.jmu.edu (Lee S. Bumgarner) wrote: > >>Is a little premeditation too much to ask for a smoothly working system? > >Yes. The _only_ info the voting process needs to know is whether the >voter is a unique individual. This is in practical terms not an >achievable task. But processes like serialized authenticated ballots at >least move in that direction. Voter registration that gathers _any_ info >beyond establishing the legitimacy of the address is a step in the wrong >direction. Information not in hand can't be abused, and I see great >potential for abuse of any sort of repository of information about voter >interests, preferences, etc. > >Further, any step toward increasing centralization seems to me counter >to the fundamental paradigm of Usenet, which owes its survival to its >decentralized nature. No system with anything like a real center could >have survived the growth of recent years. One of the last things we need >(in addition to info that can be put to abusive purposes being >collected) is any additional bottleneck. > >>in my opinion, prevents this system from being viable. If we have a >>registration system, then the cabal would be small, say 20 or so people. >>They would not be system admins, simply interested readers. > >I give you...news.groups. All that's necessary of this concept exists. >Further, by functioning in an ungoverned environment, it ensures that >what status people have is _earned_ by virtue of their views and >arguments. The current system is completely open to addition of new >figures to the pantheon. Again, centralization creates the potential for >bottlenecks. > >I don't trust _anyone_ with the power to establish a "cabal" of this >sort. I start with myself. Anyone who holds strong views of matters of >controversy faces the problem of bias, and anyone not informed enough >to hold views on them has no business selecting authority figures. I remember how someone recently argued on news.groups that Bruce Bough's votes should be invalidated because he's dying from AIDS. I strongly disagree with Dan's (?) reasoning, which was, I recall, that someone with only a couple of months left to live shouldn't be telling others how to run Usenet after his death. I think we should consider Bruce's opinions as being representative. After all, a Usenet vote is an interest poll, and the voters are just a sample of a larger population. Not everyone who thinks like Bruce Bough is going to die together with him from AIDS within a few months (sigh). Let him vote. The use of numbered ballots (as proposed by Dr. Grubor and implemented by me), will stop the following kinds of net-abuse: * Cabal supporters such as Russ Allberry (spit) e-mailing pre-filled ballots to their mailing lists, sometimes gathering tens of thousands of votes from people who haven't read the CFV; * Cabal supporters forging cancels to censor Usenet articles they claim contain "unauthorized voting instructions". This pretext has been used to stifle campaigning against the proposals the Cabal wanted to pass, as well as to suppress protests against UVV misconduct by Jan Isley (spit) and his cohorts. The use of a simple randomized question about the CFV - find the line that says this and fill in the missing word on the ballot (as proposed by Dr. Grubor and implemented by me), will stop the following kinds of net-abuses: * Cabal supporters such as Stephanie da Silva (spit) vote YES on every moderated newsgroup without reading the CFV; * Cabal supporters such as Chris Stein (spit) vote NO on every unmoderated newsgroup without reading the CFV. There can be no pre-filled ballots under Dr. Grubor's proposal. But Dr. Grubor's proposals don't address the issue of votetaker fraud. For example, we've exposed Jan Isley (spit) as a liar and a forger, who frivolously "invalidated" or "lost" votes from people he didn't like (including myself), and forged cancels for their protests on news.groups. Emory University called Isley's (spit) forgeries "reprehensible" and pulled his plug for net-abuse. The UVV's refusal to use numbered ballots and to ask (simple) questions about the CFV on the ballot is just a lame excuse. They really want to be able to forge cancels for protests posted to news.groups about votetaker misconduct. For example, of the following dozen votes I've cast, I've only received an ack for my NO vote on soc.culture.israel.moderated (fuck you, Jonathan Kamens). Where are the acks for the following ballots: 1. I e-mailed voting(a)hut.fi and wrote: I vote NO on soc.culture.israel.moderated I received an ack (thank you, Jani). 2. I e-mailed voting(a)hut.fi and wrote (ballot mark skipped): >Voter name: Dr. Dimitri Vulis > >| Insert YES, NO, ABSTAIN, or CANCEL inside the brackets for each >| newsgroup listed below (do not delete the newsgroup name): > > Your Vote Newsgroup > --------- ----------------------------------------------------------- >[ NO ] rec.arts.comics.marketplace.forsale >[ NO ] rec.arts.comics.marketplace.wanted So far, I received no ack. 3. I e-mailed voting(a)hut.fi and wrote: >I vote YES on rec.games.bridge.okbridge So far, I received no ack. 4. I e-mailed voting(a)hut.fi and wrote: >I vote YES on soc.adoption.parenting So far, I received no ack. 5. I e-mailed mtac(a)infobahn.net and wrote: >I vote NO on misc.transport.air-industry.cargo So far, I received no ack. 6. I e-mailed ccmp(a)infobahn.net and wrote: >I vote YES on comp.cad.microstation.programmer So far, I received no ack. 7. I e-mailed ceg(a)infobahn.net and wrote: >I vote YES on comp.emulators.game-consoles So far, I received no ack. 8. I e-mailed smo(a)infobahn.net and wrote: >I vote NO on sci.med.obgyn So far, I received no ack. 9. I e-mailed saf(a)infobahn.net and wrote: >I vote YES on sci.agriculture.net So far, I received no ack. 10. I e-mailed david.bostwick(a)chemistry.gatech.edu and wrote: >Give your real name here: Dr. Dimitri Vulis >If you do not give your real name, your vote may be rejected. > >[Your Vote] Group (Place your vote below in the brackets next to the group) >------------------------------------------------------------------------- >[YES ] comp.lang.dfl So far, I received no ack. 11. I e-mailed david.bostwick(a)chemistry.gatech.edu and wrote: >Give your real name here: Dr. Dimitri Vulis >If you do not give your real name, your vote may be rejected. > >[Your Vote] Group (Place your vote below in the brackets next to the group) >------------------------------------------------------------------------- >[ YES ] misc.invest.misc (renames misc.invest) >[ YES ] misc.invest.mutual-funds (renames misc.invest.funds) >[ YES ] misc.invest.options >[ YES ] misc.invest.marketplace So far, I received no ack. 12. I e-mailed dhartung(a)mcs.com and wrote: >Give your real name here: Dr. Dimitri Vulis >If you do not give a real name on the above line your vote may be rejected. > >[Your Vote] Group >----------------------------------------------------------------------- >[NO ] soc.religion.paganism So far, I received no ack. What's going on? Why are 11 of my ballots not being acknowledged? =============================================================================== Article 2: =============================================================================== Path: ...!newsfeed.internetmci.com!usenet.eel.ufl.edu!psgrain!rainrgnews0!news.aracnet.com!mycroft From: bruce(a)kenosis.com (Bruce Baugh) Newsgroups: news.admin.net-abuse.misc,news.groups,alt.usenet.kooks Subject: Re: Towards A Usenet Social Contract Date: Sun, 14 Jul 96 00:17:16 GMT Organization: Kenosis Design Lines: 29 Message-ID: <4s9eac$1ag_006(a)mycroft.kenosis.com> References: <4rpvfi$smg(a)doc.jmu.edu> <4rv6m7$3ns_002(a)mycroft.kenosis.com> <i6a1qD209w165w(a)bwalk.dm.com> NNTP-Posting-Host: ppp-u11.aracnet.com Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII X-Newsreader: News Xpress 2.0 Beta #2 In article <i6a1qD209w165w(a)bwalk.dm.com>, dlv(a)bwalk.dm.com (Dr. Dimitri Vulis) wrote: >of a larger population. Not everyone who thinks like Bruce Bough is going to >die together with him from AIDS within a few months (sigh). Let him vote. Dimitri, I invite you to pick a date, not more than twelve months in the future, beyond which you're certain I will die. I will then post the next day. Not, of course, that I expect you to have the honor to admit now that you're deliberately misreading and misunderstanding my posts, nor to admit in the future that you made a claim demonstrably wrong. Nor, I see, can you spell my name correctly, even though you quote it routinely in reply lines and sig files. People who can't read what's in front of them on screen lose credibility when it comes to proposing sweeping changes and radical innovations in software. Further, you might want to read up on the Americans With Disabilities Act. Slanderous and defamatory statements about the handicapped - and my government agrees that I do have a real problem, though it's not AIDS - open you up to interesting liability. Bruce Baugh <*> bruce(a)aracnet.com <*> http://www.aracnet.com/~bruce See my Web pages for New science fiction by Steve Stirling and George Alec Effing er Christlib, the mailing list for Christian and libertarian concerns Daedalus Games, makers of Shadowfist and Feng Shui Unsolicited commercial e-mail will be proofread at $50/hour, min $100. ===============================================================================

1 0

setting up disposable remailers
by Adam Back 17 Dec '03

17 Dec '03

Some thoughts on solutions to the remailer operator liability problem. It occurs to me that the risk for the remailer owner could be reduced by separating concerns. That is, introducing separate roles for setting up the remailer so that the identity of as many parties as possible is not determinable to the litigator. Model 1 ------- Separable roles: - person owning the remailer - person installing remailer software - person handling complaints to the remailer In this model a new remailer owner would anonymously email a member of the cypherpunks list asking if they would be interested in installing a remailer in the owners provided account. The remailer owner would anonymously open an account with an ISP offering anonymous shell accounts, and accepting digicash, or cash, and anonymously email the account details to the installer. Optionally, a third party (the maintainer) could be persuaded to accept complaints for the remailer, and (anonymously) send signed instructions to the remailer to bar certain receiving addresses. The only determinable target for a typical litigator would be the ISP. If a more powerful adversary were the litigator, such as a TLA anxious to demonstrate an excuse for it's continued existance, it is possible they may retrieve the identity of the installer (if they do indeed have taps and large IP traffic recording facilities for instance). They may try to hold the installer responsible if unable to find the owner. Model 2 goes some way to reducing risk for the installer. Model 2 ------- In this model the additional separable role of setting up a shell command mail processor on the account is introduced. What I mean by this is as has been discussed on the list recently, that a mail handler which executes signed shell commands emailed, and anonymously emails back the command output. That is to say the remailer owner now passes the account information to the installer of the mail processor. The shell installer sets up the command processor, and leaves. Now the owner gives the PGP secret key of the command processor to the remailer installer (or if the owner feels competent, does this part themselves). Provided that the anonymous remailers used for all of the steps are type2 mixmaster remailers, the system should be much more secure. Adam -- #!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj $/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1 lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/)

1 0

Re: Stuffs used for detection
by Remo Pini 17 Dec '03

17 Dec '03

At 09:52 PM 7/12/96 +0800, you wrote: >In our school library, there is a depository area wherein you deposit your things and get the tag. Since the library doesn't allow those tags to be brought out from the library, everytime you brought it out and pass by the door, it will alarm. Does anyone know what stuff is that? How come it is alarmed? I brought some metals but it wouldn't alarm... Why those tag would alarm them??? > Most of these systems are made of an oszillator (basically a few windings of a wire with a capacitor: ------ / \ Š--ŠŠ--Š \ / ------ This acts like an ordinary RLC-Oszillator. When you put it in a electrical field with the right frequency, it will effect the field strong enough to be detectable. So, if you shield it, you win. ----------< fate favors the prepared mind >---------- Remo Pini Fon 1: +41 1 350 28 82 mailto:rp@rpini.com Fon 2: +41 1 465 31 90 http://www.rpini.com/remopini/ Fax: +41 1 350 28 84 --------< words are what reality is made of >--------

2 1

PKI Documents
by jya＠pipeline.com 17 Dec '03

17 Dec '03

http://csrc.ncsl.nist.gov/pki/ ---------- Public Key Infrastructure Pardon our mess. This page is under construction. Additional files, and additional formats, will be added in the near future. Your patience is appreciated! The following documents are products of the Federal PKI Steering Committee's Technical Working Group. Together, they comprise Version 1 of the Technical Specifications for the Federal PKI. + Requirements for the Federal Public Infrastructure (PostScript) [265366 bytes] This is Part A: of the Technical Specifications, the Draft Requirements for the Federal PKI. + Technical Security Policy for the Federal PKI (PostScript) [163543 bytes] This is Part B: of the Technical Specifications, the Draft Technical Security Policy for the Federal PKI. + Proposed Federal PKI Concept of Operations (PostScript) [980672 bytes] This is the Part C: of Technical Specifications, the Concept of Operations for the Federal PKI. + Interoperability Profile (PostScript) [746328 bytes] This is Part D: of the Technical Specifications, Draft Interoperability Profiles for the Federal PKI. Contractor Reports: the following reports were developed by contractors for NIST. These reports do not constitute government positions, but rather detail the advice and guidance provided to the government regarding public key infrastructure. + The 1994 Mitre PKI Study Final Report. [1461396 bytes] This report describes a federal PKI based on a strict hierarchical architecture, using X.509 version 2 certificates. + A Public Key Infrastructure for Unclassified but Sensitive Applications. [946734 bytes] This 1995 report describes a federal PKI based on a network architecture using the X.509 version 3 certificate. [End]

1 0

GIB_ber
by jya＠pipeline.com 17 Dec '03

17 Dec '03

6-13-96. NYP: Markoff: "Clinton Proposes Initiatives On the Scrambling of Data." Under increasing pressure from Congress and the computer industry, the Clinton Administration proposed a series of new data-scrambling policy initiatives yesterday that it said would address the Government's national security concerns while also permitting American companies to compete more effectively overseas. 6-14-96. NYP: William Gibson: "The Net Is a Waste of Time. And that's exactly what's right about it." The Web, in its clumsy, larval, curiously innocent way, offers us the opportunity to waste time, to wander aimlessly, to daydream about the countless other lives, the other people, on the far sides of however many monitors in that postgeographical meta-country we increasingly call home. It will probably evolve into something considerably less random, but in the meantime, in its gloriously unsorted Global Ham Television Postcard Universes phase, surfing the Web is a procrastinator's dream. And people who see you doing it might even imagine you're working. http://pwp.usa.pipeline.com/~jya/gibber.txt (13 kb for 2) GIB_ber (for 2)

1 0

HotWired -- "Crypto Storm Warning"
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Sun, 14 Jul 1996 20:19:33 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship+(a)andrew.cmu.edu Subject: HotWired -- "Crypto Storm Warning" >From Monday's The Netizen on HotWired. Read the full text at the URL below. Gorelick spoke last Friday at the Freedom Forum in Virginia. -Declan --- http://www.netizen.com/netizen/96/29/campaign_dispatch0a.html HotWired The Netizen "Crypto Storm Warning" Campaign Dispatch by Declan McCullagh (declan(a)well.com) Washington, DC, 14 July The Clinton administration escalated its cyber-fearstorm today when a top Justice Department lawyer slammed the Net for "transmitting child pornography into our homes" and for allowing hackers to possibly "shut down the banking system." [...] At the same time, [Jamie] Gorelick edged away from the hard-line rhetoric the administration used to defend the Communications Decency Act. [...] Gorelick's cybercondemnations play against a backdrop of political jockeying inside the Justice Department. Reno disclosed last November that she has Parkinson's disease, and Gorelick is her logical successor if Clinton stays in office next term. [...] After Gorelick completed her speech and sat down, I leaned over and asked her: "Could I have your email address?" She didn't know it. "I don't go into it that often," Gorelick said, adding that the Justice Department doesn't use email much, for "security reasons." "Call me and I'll give it to you," she promised. Gosh, what a surprise: The US government's leading spokesperson on the dangers and the evils of the Net doesn't even log in.

1 0

Re: Word lists for passphrases
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:43 PM 7/8/96 -0700, you wrote: >If the purpose is for use with "Crack" or some similar program, it might be >better than you would think. You won't get the "unusual" words, but you >will also get the words in common usage that do not appear in dictionaries. >(Such as fnord, jedi, killfile, and the like...) "fnord" is in _my_ dictionary - can't you find it in yours? :-) >Another thing to look for when choosing dictionaries/wordlists for crack is >not sticking to english. If you have a userbase that is known to have a >certain percentage of people of a non-english background, you will want to >find lists of words from that background. (I had a sysadmin asking me about >Yiddish and Hebrew wordlists for just that reason.) These can be a bit >harder. (Especially for unusual languages.) Grady Ward has his Moby Words databases with some of this kind of information. In addition to the usual sets of languages, it's useful to include any available lexicons of Elvish, Klingon, Unix, and other popular hacker-languages, plus any names you can scam off MUDs, etc. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Re-delegate Authority!

3 2